That will validate that the user belongs to the 'some-team' team of the 'my-company' organization on github.

You can also use a whitelist of users, like this.

var githubAuth =require('github-auth');

var config ={

users:['sorribas','mafintosh','octocat']

};

var gh = githubAuth('github app id','github app secret', config);

app.use(gh.authenticate);

The authenticate middleware sets the req.github property to an object which contains
user and authenticated. That way you can decide what to do with unauthenticated users
(redeirect them to the login page for example). If the req.github object is not present
it means that the user has not tried to login, so you should redirect them to the github
login page which is on gh.loginUrl

You can also use the .login middleware which redirects you to the github oauth login page.

app.get('ghlohin', gh.login);

To get the users in a team with the github API you need the full write access on the user
profile, which is not really nice. You can avoid this by passing some github credentials
with access to the team to the module so it uses basic HTTP auth.